Field of Invention
Example embodiments relate generally to a system and a method for detecting anomalies from events that have a non-homogenous arrival rate.
Related Art
A counting process may be implemented to detecting anomalies in a counting process, such as a counting of incoming calls at a customer care center. During normal conditions, the counting process may have a time varying expected arrival rate, which may be considered as an example of a non-homogenous Poisson process. Within such a non-homogenous Poisson process, an anomaly may be a deviation from an expected arrival rate.
Existing methods may be based on fixed time windows, where time may be divided into equally sized windows and monitored for an aggregate count of events in within the windows. In particular, one conventional approach uses a pair of control charts, where one of the charts may be used to monitor for change, and the other chart may be used to monitor for an end of change. However, this approach may include several disadvantages, for at least a couple of reasons: 1) the method may not work well with counting processes with sparse arrivals, and 2) the method may assume that the rate is constant. An example of this type of approach has been disclosed in the following document: Bila, Nihon, Cao, Dinoff, Ho, Kumar, Liewen and Santos, “Intuitive network applications: Learning user context and behavior,” Bell Labs Technical Journal, 13, No. 2 (2008), p. 31-47.
Another conventional approach uses measurements made at fixed time windows (e.g. KPIs in each 15 minute window). Although this approach may accommodate time varying rates, this approach may have several disadvantages, including: 1) the method does not work well for very low rates, and 2) the method may not be a streaming algorithm (i.e., it does not provide a response with each arrival, but rather waits until the end of each time window). An example of this type of approach has been disclosed in the following document: Cao, Chen, Bu, Buvaneswari, “Monitoring Time-Varying Network Streams Using State-Space Models,” INFOCOM (2009), IEEE, p. 2721-2725.